System, method and computer program product for serving an application from a custom subdomain

ABSTRACT

In accordance with embodiments, there are provided mechanisms and methods for serving an application from a custom subdomain. These mechanisms and methods for serving an application from a custom subdomain can enable improved data security, enhanced system performance, optimized resource utilization, etc.

CLAIM OF PRIORITY

This application is a continuation of U.S. application Ser. No.14/173,754, filed Feb. 5, 2014, which is a continuation of U.S.application Ser. No. 13/048,807, filed Mar. 15, 2011, which claims thebenefit of U.S. Provisional Patent Application 61/314,003, filed Mar.15, 2010, the entire contents of which are incorporated herein byreference.

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure, as it appears in the Patent and TrademarkOffice patent file or records, but otherwise reserves all copyrightrights whatsoever.

FIELD OF THE INVENTION

One or more implementations relate generally to serving applications,and more particularly to establishing custom subdomains for servingapplications.

BACKGROUND

The subject matter discussed in the background section should not beassumed to be prior art merely as a result of its mention in thebackground section. Similarly, a problem mentioned in the backgroundsection or associated with the subject matter of the background sectionshould not be assumed to have been previously recognized in the priorart. The subject matter in the background section merely representsdifferent approaches, which in and of themselves may also be inventions.

Conventional systems commonly utilize generic uniform resource locators(URLs) associated with an instance of the system in order to serveapplications located within the system. For example, when a user signsinto an organization of the system, they may be sent to an address of aninstance on which the organization resides. Unfortunately, techniquesfor utilizing generic URLs to serve system applications have beenassociated with various limitations.

Just by way of example, security issues (e.g., the use of hijackedcookies to access unauthorized system organizations, etc.) may existwith traditional methods of utilizing generic URLs to serve systemapplications. Additionally, when the location at which an organizationresides is changed (e.g., due to space constraints, etc.), a new genericURL may be required, which may result in broken links associated withapplications of the organization. Accordingly, it is desirable tooptimize the use of URLs to serve applications within the system.

BRIEF SUMMARY

In accordance with embodiments, there are provided mechanisms andmethods for serving an application from a custom subdomain. Thesemechanisms and methods for serving an application from a customsubdomain can enable improved data security, enhanced systemperformance, optimized resource utilization, etc.

In an embodiment and by way of example, a method for serving anapplication from a custom subdomain is provided. In one embodiment, aselection of a custom subdomain is received from an organization of asystem. Additionally, the custom subdomain is associated with theorganization of the system. Further, an application of the organizationis served from the custom subdomain.

While one or more implementations and techniques are described withreference to an embodiment in which serving an application from a customsubdomain is implemented in a system having an application serverproviding a front end for an on-demand database system capable ofsupporting multiple tenants, the one or more implementations andtechniques are not limited to multi-tenant databases nor deployment onapplication servers. Embodiments may be practiced using other databasearchitectures, i.e., ORACLE®, DB2® by IBM and the like without departingfrom the scope of the embodiments claimed.

Any of the above embodiments may be used alone or together with oneanother in any combination. The one or more implementations encompassedwithin this specification may also include embodiments that are onlypartially mentioned or alluded to or are not mentioned or alluded to atall in this brief summary or in the abstract. Although variousembodiments may have been motivated by various deficiencies with theprior art, which may be discussed or alluded to in one or more places inthe specification, the embodiments do not necessarily address any ofthese deficiencies. In other words, different embodiments may addressdifferent deficiencies that may be discussed in the specification. Someembodiments may only partially address some deficiencies or just onedeficiency that may be discussed in the specification, and someembodiments may not address any of these deficiencies.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following drawings like reference numbers are used to refer tolike elements. Although the following figures depict various examples,the one or more implementations are not limited to the examples depictedin the figures.

FIG. 1 illustrates a method for serving an application from a customsubdomain, in accordance with one embodiment;

FIG. 2 illustrates a method for establishing a custom subdomain, inaccordance with another embodiment;

FIG. 3 illustrates a block diagram of an example of an environmentwherein an on-demand database system might be used; and

FIG. 4 illustrates a block diagram of an embodiment of elements of FIG.3 and various possible interconnections between these elements.

DETAILED DESCRIPTION General Overview

Systems and methods are provided for serving an application from acustom subdomain.

As used herein, the term multi-tenant database system refers to thosesystems in which various elements of hardware and software of thedatabase system may be shared by one or more customers. For example, agiven application server may simultaneously process requests for a greatnumber of customers, and a given database table may store rows for apotentially much greater number of customers.

Next, mechanisms and methods for serving an application from a customsubdomain will be described with reference to example embodiments.

FIG. 1 illustrates a method 100 for serving an application from a customsubdomain, in accordance with one embodiment. As shown in operation 102,a selection of a custom subdomain is received from an organization of asystem. In one embodiment, the custom subdomain may include any domainthat is part of a larger domain of the system. For example, for a systemdomain named “system.com,” a custom subdomain named “custom” may beselected such that the full domain name is “custom.system.com.”

In another embodiment, the custom subdomain may be selected utilizingone or more resources of the system. For example, the custom subdomainmay be selected utilizing a set up page provided by the system. In yetanother embodiment, the custom subdomain may be associated with a nameof the organization. For example, the organization may select the nameof the organization as the custom subdomain.

Additionally, in one embodiment, the organization may include any entityassociated with the system. For example, the organization may include atenant of the system, a client of the system, etc. In anotherembodiment, the organization may include an individual, a corporation,or any other entity. In yet another embodiment, the system may include aclient, a server, a multi-tenant on-demand database system, etc.

Additionally, it should be noted that, as described above, suchmulti-tenant on-demand database system may include any service thatrelies on a database system that is accessible over a network, in whichvarious elements of hardware and software of the database system may beshared by one or more customers (e.g. tenants). For instance, a givenapplication server may simultaneously process requests for a greatnumber of customers, and a given database table may store rows for apotentially much greater number of customers. Various examples of such amulti-tenant on-demand database system will be set forth in the contextof different embodiments that will be described during reference tosubsequent figures.

Furthermore, as shown in operation 104, the custom subdomain isassociated with the organization of the system. In one embodiment, theassociating may be performed by the system. In another embodiment, theassociating may include checking the availability of the customsubdomain, confirming that the custom subdomain is not prohibited, etc.In yet another embodiment, the associating may include requesting adomain name system (DNS) alias from the selected custom subdomain to alocation within the system. In still another embodiment, the customsubdomain may be associated with an instance of the organization withinthe system. Of course, however, the custom subdomain may be associatedwith the organization of the system in any manner.

Further still, as shown in operation 106, an application of theorganization is served from the custom subdomain. In one embodiment, theapplication of the organization may be web-based. For example, theapplication of the organization may be accessed via the Internet. Inanother embodiment, the application of the organization may be accessedby inputting into a browser a full uniform resource locator (URL) forthe application including the custom subdomain. For example, if thesystem domain is named “system.com,” and the custom subdomain named isnamed “custom,” then the application may be accessed by entering the URL“custom.system.com” into a web browser.

In one embodiment, the custom subdomain may replace an instance specificsubdomain. For example, the organization named “organization” may resideon an instance of the system labeled “NA1,” and the application of theorganization may originally be served from the instance specificsubdomain of “NA1.system.com.” However, after selecting the customsubdomain of “organization,” the application of the organization may beserved from the custom subdomain of “organization.system.com.” In thisway, one or more users may log into different organizations that resideon the same instance of the system at the same time. Additionally, thecustom subdomain may enable the organization to migrate from oneinstance of the server to another instance in a manner that istransparent to users of the application (e.g., without resulting inbroken application links, etc.).

Further, in one embodiment, one or more authentication elements (e.g.,web browser cookies, etc.) may be assigned to the custom subdomain. Inthis way, scripting problems and cookie hijacking may be avoided,thereby increasing system security. In another embodiment, the systemmay identify the organization based on a URL submitted to the systemthat includes the custom subdomain. In this way, the organization may beidentified earlier in the application service process, and networktraffic, system resources, and other elements may be managed moreefficiently.

FIG. 2 illustrates a method 200 for establishing a custom subdomain, inaccordance with another embodiment. As an option, the present method 200may be carried out in the context of the functionality of FIG. 1. Ofcourse, however, the method 200 may be carried out in any desiredenvironment. The aforementioned definitions may apply during the presentdescription.

As shown in operation 202, a customer of a system accesses a domainsetup page of the system. In one embodiment, the customer of the systemmay include an organization registered within the system. In anotherembodiment, the domain setup page may include a web page accessible bythe customer. In yet another embodiment, if an organization associatedwith the customer has an OrgDomain perm, there may be a new entry in asetup tree (e.g., under company information, etc.) that may beidentified as custom domain. The new entry may present a user interface(UI) similar to a domain registration page of the system, and may allowthe customer to pick a domain, check its availability, and then registerit.

Additionally, as shown in operation 204, the customer inputs a desiredsubdomain name into the domain setup page and submits it to the system.Further, as shown in operation 206, the desired subdomain is verified,and the customer's organization within the system is associated with thedesired subdomain. In one embodiment, the verification of the desiredsubdomain may include confirming the availability of the subdomain. Forexample, registration of the domain may be done via a system page whichmay validate that the desired subdomain is unique and not a prohibiteddomain.

In another embodiment, the customer may select a register/save icon, andan organization value may be committed, while an outbound message may besent to create a canonical name (CNAME) record. For example, the customsubdomain may be stored as an organization value within the system, andthe feature may be hidden behind a perm. In another example, once thecustomer registers the subdomain, a message may be added on an outboundmessaging queue that may send a request to create a CNAME record. In yetanother embodiment, the system may request a DNS alias from the desiredsubdomain to the location of the customer's organization within thesystem, and may confirm the propagation to DNS.

In still another embodiment, the customer may access the system via aninstance URL, and may proceed to register their domain at which pointthe system may send a request to make the CNAME update. Additionally,some background polling of DNS may be performed by the system to ensurethat the custom subdomain is truly accessible before switching. Inanother embodiment, the system may send customers a URL such as“mycompany.<instancename>.system.com” temporarily. In anotherembodiment, a message may be sent to an asynchronous queue that maycheck DNS in 24 hours and if the change is in, flip some bit on theorganization that may indicated that redirection is an option.Otherwise, the message may be re-enqueued and checked again in another24 hours. Further, in one embodiment, the selected subdomain may not beallowed to change once it is established for an organization.

In yet another embodiment, a proxy may be introduced that may sit infront of all instances of the system in a data center. The proxy maycontain the logic to route a request to a specific instance so allorganizations may be handled with a wildcard ANAME entry (e.g.,“*.mycrm.com,” etc.). In this way, the notion of instances may beabstracted away from customers. Additionally, a plurality of IPs may befreed up since instance VIPs may no longer be needed. Further, the proxymay route the request dynamically in a variety of ways. One option is ifthe proxy is squid, an external ACL helper written in Java, Perl or anyother language may reload a config file containing all of the mappingsduring a predetermined time interval (e.g., every five minutes, etc.).When an organization domain is created/updated/deleted, an appserver maysend a request to some service listing on the proxy box that may updatethe file.

Further still, as shown in operation 208, a testing phase of the customsubdomain usage is initiated. In one embodiment, users associated withthe organization may still log in and access applications of theorganization within the system utilizing a URL with an instance specificsubdomain, but may also log in and access applications utilizing a URLwith the custom subdomain.

Also, as shown in operation 210, the custom subdomain is deployed to allusers associated with the organization. In one embodiment, all usersassociated with the organization may be directed to the URL with thecustom subdomain when logging in to the system. For example, if anOrgDomains perm is enabled, the user may be redirected to the customsubdomain and a sid cookie may be set on that domain. In anotherembodiment, instance specific subdomains may still be supported afterthe custom subdomain is deployed to all users.

Additionally, in one embodiment, one or more security features may beimplemented utilizing the custom subdomain. For example, users of theorganization may be required to log in to the system utilizing a URLwith the custom subdomain. In this way, security threats (e.g.,phishing, etc.) may be avoided. In another example, the organizationassociated with a user may be determined from the URL the user uses tolog in with. In this way, valid users may be verified more efficiently(e.g., from a list of users of the particular organization, etc.).

In yet another example, one or more actions may be performed on anorganization-specific basis at a load balancer level of the systembefore it reaches the application tier. In this way, an attack on anorganization within the system may be blocked before it reaches theapplication tier, thereby improving performance by avoiding expensivelogins. In another example, users from one organization within thesystem may be prevented from using the login URL of another organizationwithin the system. In yet another example, one or more entities may havepolicies that restrict outgoing network traffic based on the requestedURL with a custom subdomain. In this way, only a single URL may need tobe added to a whitelist, blacklist, IP restrictions, utilized for securesockets layer (SSL) and security assertion markup language (SAML) signon, etc.

Further, in one embodiment, the system may implement one or moreoptimizations utilizing the custom subdomain. For example, a lookuptable may be used to indicate the location of each system organization,and the organization may be identified from the custom subdomain. Inthis way, cross-instance calls (e.g., that determine which instance isassociated with the organization, etc.) may be avoided, therebyminimizing network traffic-intensive processing and increasingperformance.

In another example, utilizing the custom subdomain of a requested URL,the organization may be identified, and the system may determine whetherthe organization has exceeded their bandwidth allowance before usingbandwidth to log users of the organization into the system. In yetanother example, a load balancer of the system may be informed of theorganization to be accessed when a user attempts to log into the systemutilizing the custom subdomain of a requested URL, and may determine anamount of generated traffic, provide special pages for login, etc. Inanother embodiment, branded login pages may be implemented for theorganization, utilizing the custom subdomain.

Further still, in one embodiment, one or more cookies may be set on thesystem domain (e.g., oinfo, etc.) which may be used to profile usersvisiting system websites. This may be done after the user isauthenticated and before they are redirected to the custom subdomain. Inanother embodiment, when an organization is migrated within the system,a CNAME update may be done to point the custom subdomain to the newinstance. Additionally, the CNAME update may be built into a systemmigration tool so that it can be done programatically. In order to allowcustomers to log in during the 24 hr period that a DNS change may taketo propagate, an instance specific subdomain URL (e.g.,“companyname.<new instance name>.system.com,” etc.) may be used. Inanother embodiment, organizations that have organization domains enabledmay not be migrated.

In this way, security may be improved by allowing better use of abrowser security model (e.g., for XSS or phishing, etc.). Additionally,transparent organization migration may be performed within the system(e.g., that doesn't need to account for instances within the system,etc.). Further, organization throttling may be improved within thesystem. Further still, branded login pages may be provided. Also, IPrange enforcement may be supported prior to logging in. In addition,users may be able to log into multiple organizations within the systemregardless of instance. Furthermore, SSO support may be bettersupported, and IP space may be freed up.

System Overview

FIG. 3 illustrates a block diagram of an environment 310 wherein anon-demand database system might be used. Environment 310 may includeuser systems 312, network 314, system 316, processor system 317,application platform 318, network interface 320, tenant data storage322, system data storage 324, program code 326, and process space 328.In other embodiments, environment 310 may not have all of the componentslisted and/or may have other elements instead of, or in addition to,those listed above.

Environment 310 is an environment in which an on-demand database systemexists. User system 312 may be any machine or system that is used by auser to access a database user system. For example, any of user systems312 can be a handheld computing device, a mobile phone, a laptopcomputer, a work station, and/or a network of computing devices. Asillustrated in FIG. 3 (and in more detail in FIG. 4) user systems 312might interact via a network 314 with an on-demand database system,which is system 316.

An on-demand database system, such as system 316, is a database systemthat is made available to outside users that do not need to necessarilybe concerned with building and/or maintaining the database system, butinstead may be available for their use when the users need the databasesystem (e.g., on the demand of the users). Some on-demand databasesystems may store information from one or more tenants stored intotables of a common database image to form a multi-tenant database system(MTS). Accordingly, “on-demand database system 316” and “system 316”will be used interchangeably herein. A database image may include one ormore database objects. A relational database management system (RDMS) orthe equivalent may execute storage and retrieval of information againstthe database object(s). Application platform 318 may be a framework thatallows the applications of system 316 to run, such as the hardwareand/or software, e.g., the operating system. In an embodiment, on-demanddatabase system 316 may include an application platform 318 that enablescreation, managing and executing one or more applications developed bythe provider of the on-demand database system, users accessing theon-demand database system via user systems 312, or third partyapplication developers accessing the on-demand database system via usersystems 312.

The users of user systems 312 may differ in their respective capacities,and the capacity of a particular user system 312 might be entirelydetermined by permissions (permission levels) for the current user. Forexample, where a salesperson is using a particular user system 312 tointeract with system 316, that user system has the capacities allottedto that salesperson. However, while an administrator is using that usersystem to interact with system 316, that user system has the capacitiesallotted to that administrator. In systems with a hierarchical rolemodel, users at one permission level may have access to applications,data, and database information accessible by a lower permission leveluser, but may not have access to certain applications, databaseinformation, and data accessible by a user at a higher permission level.Thus, different users will have different capabilities with regard toaccessing and modifying application and database information, dependingon a user's security or permission level.

Network 314 is any network or combination of networks of devices thatcommunicate with one another. For example, network 314 can be any one orany combination of a LAN (local area network), WAN (wide area network),telephone network, wireless network, point-to-point network, starnetwork, token ring network, hub network, or other appropriateconfiguration. As the most common type of computer network in currentuse is a TCP/IP (Transfer Control Protocol and Internet Protocol)network, such as the global internetwork of networks often referred toas the “Internet” with a capital “I,” that network will be used in manyof the examples herein. However, it should be understood that thenetworks that the one or more implementations might use are not solimited, although TCP/IP is a frequently implemented protocol.

User systems 312 might communicate with system 316 using TCP/IP and, ata higher network level, use other common Internet protocols tocommunicate, such as HTTP, FTP, AFS, WAP, etc. In an example where HTTPis used, user system 312 might include an HTTP client commonly referredto as a “browser” for sending and receiving HTTP messages to and from anHTTP server at system 316. Such an HTTP server might be implemented asthe sole network interface between system 316 and network 314, but othertechniques might be used as well or instead. In some implementations,the interface between system 316 and network 314 includes load sharingfunctionality, such as round-robin HTTP request distributors to balanceloads and distribute incoming HTTP requests evenly over a plurality ofservers. At least as for the users that are accessing that server, eachof the plurality of servers has access to the MTS' data; however, otheralternative configurations may be used instead.

In one embodiment, system 316, shown in FIG. 3, implements a web-basedcustomer relationship management (CRM) system. For example, in oneembodiment, system 316 includes application servers configured toimplement and execute CRM software applications as well as providerelated data, code, forms, webpages and other information to and fromuser systems 312 and to store to, and retrieve from, a database systemrelated data, objects, and Webpage content. With a multi-tenant system,data for multiple tenants may be stored in the same physical databaseobject, however, tenant data typically is arranged so that data of onetenant is kept logically separate from that of other tenants so that onetenant does not have access to another tenant's data, unless such datais expressly shared. In certain embodiments, system 316 implementsapplications other than, or in addition to, a CRM application. Forexample, system 316 may provide tenant access to multiple hosted(standard and custom) applications, including a CRM application. User(or third party developer) applications, which may or may not includeCRM, may be supported by the application platform 318, which managescreation, storage of the applications into one or more database objectsand executing of the applications in a virtual machine in the processspace of the system 316.

One arrangement for elements of system 316 is shown in FIG. 3, includinga network interface 320, application platform 318, tenant data storage322 for tenant data 323, system data storage 324 for system data 325accessible to system 316 and possibly multiple tenants, program code 326for implementing various functions of system 316, and a process space328 for executing MTS system processes and tenant-specific processes,such as running applications as part of an application hosting service.Additional processes that may execute on system 316 include databaseindexing processes.

Several elements in the system shown in FIG. 3 include conventional,well-known elements that are explained only briefly here. For example,each user system 312 could include a desktop personal computer,workstation, laptop, PDA, cell phone, or any wireless access protocol(WAP) enabled device or any other computing device capable ofinterfacing directly or indirectly to the Internet or other networkconnection. User system 312 typically runs an HTTP client, e.g., abrowsing program, such as Microsoft's Internet Explorer browser,Netscape's Navigator browser, Opera's browser, or a WAP-enabled browserin the case of a cell phone, PDA or other wireless device, or the like,allowing a user (e.g., subscriber of the multi-tenant database system)of user system 312 to access, process and view information, pages andapplications available to it from system 316 over network 314. Each usersystem 312 also typically includes one or more user interface devices,such as a keyboard, a mouse, trackball, touch pad, touch screen, pen orthe like, for interacting with a graphical user interface (GUI) providedby the browser on a display (e.g., a monitor screen, LCD display, etc.)in conjunction with pages, forms, applications and other informationprovided by system 316 or other systems or servers. For example, theuser interface device can be used to access data and applications hostedby system 316, and to perform searches on stored data, and otherwiseallow a user to interact with various GUI pages that may be presented toa user. As discussed above, embodiments are suitable for use with theInternet, which refers to a specific global internetwork of networks.However, it should be understood that other networks can be used insteadof the Internet, such as an intranet, an extranet, a virtual privatenetwork (VPN), a non-TCP/IP based network, any LAN or WAN or the like.

According to one embodiment, each user system 312 and all of itscomponents are operator configurable using applications, such as abrowser, including computer code run using a central processing unitsuch as an Intel Pentium® processor or the like. Similarly, system 316(and additional instances of an MTS, where more than one is present) andall of their components might be operator configurable usingapplication(s) including computer code to run using a central processingunit such as processor system 317, which may include an Intel Pentium®processor or the like, and/or multiple processor units. A computerprogram product embodiment includes a machine-readable storage medium(media) having instructions stored thereon/in which can be used toprogram a computer to perform any of the processes of the embodimentsdescribed herein. Computer code for operating and configuring system 316to intercommunicate and to process webpages, applications and other dataand media content as described herein are preferably downloaded andstored on a hard disk, but the entire program code, or portions thereof,may also be stored in any other volatile or non-volatile memory mediumor device as is well known, such as a ROM or RAM, or provided on anymedia capable of storing program code, such as any type of rotatingmedia including floppy disks, optical discs, digital versatile disk(DVD), compact disk (CD), microdrive, and magneto-optical disks, andmagnetic or optical cards, nanosystems (including molecular memory ICs),or any type of media or device suitable for storing instructions and/ordata. Additionally, the entire program code, or portions thereof, may betransmitted and downloaded from a software source over a transmissionmedium, e.g., over the Internet, or from another server, as is wellknown, or transmitted over any other conventional network connection asis well known (e.g., extranet, VPN, LAN, etc.) using any communicationmedium and protocols (e.g., TCP/IP, HTTP, HTTPS, Ethernet, etc.) as arewell known. It will also be appreciated that computer code forimplementing embodiments can be implemented in any programming languagethat can be executed on a client system and/or server or server systemsuch as, for example, C, C++, HTML, any other markup language, Java™,JavaScript, ActiveX, any other scripting language, such as VBScript, andmany other programming languages as are well known may be used. (Java™is a trademark of Sun Microsystems, Inc.).

According to one embodiment, each system 316 is configured to providewebpages, forms, applications, data and media content to user (client)systems 312 to support the access by user systems 312 as tenants ofsystem 316. As such, system 316 provides security mechanisms to keepeach tenant's data separate unless the data is shared. If more than oneMTS is used, they may be located in close proximity to one another(e.g., in a server farm located in a single building or campus), or theymay be distributed at locations remote from one another (e.g., one ormore servers located in city A and one or more servers located in cityB). As used herein, each MTS could include one or more logically and/orphysically connected servers distributed locally or across one or moregeographic locations. Additionally, the term “server” is meant toinclude a computer system, including processing hardware and processspace(s), and an associated storage system and database application(e.g., OODBMS or RDBMS) as is well known in the art. It should also beunderstood that “server system” and “server” are often usedinterchangeably herein. Similarly, the database object described hereincan be implemented as single databases, a distributed database, acollection of distributed databases, a database with redundant online oroffline backups or other redundancies, etc., and might include adistributed database or storage network and associated processingintelligence.

FIG. 4 also illustrates environment 310. However, in FIG. 4 elements ofsystem 316 and various interconnections in an embodiment are furtherillustrated. FIG. 4 shows that user system 312 may include processorsystem 312A, memory system 312B, input system 312C, and output system312D. FIG. 4 shows network 314 and system 316. FIG. 4 also shows thatsystem 316 may include tenant data storage 322, tenant data 323, systemdata storage 324, system data 325, User Interface (UI) 430, ApplicationProgram Interface (API) 432, PL/SOQL 434, save routines 436, applicationsetup mechanism 438, applications servers 400 ₁-400 _(N), system processspace 402, tenant process spaces 404, tenant management process space410, tenant storage area 412, user storage 414, and application metadata416. In other embodiments, environment 310 may not have the sameelements as those listed above and/or may have other elements insteadof, or in addition to, those listed above.

User system 312, network 314, system 316, tenant data storage 322, andsystem data storage 324 were discussed above in FIG. 3. Regarding usersystem 312, processor system 312A may be any combination of one or moreprocessors. Memory system 312B may be any combination of one or morememory devices, short term, and/or long term memory. Input system 312Cmay be any combination of input devices, such as one or more keyboards,mice, trackballs, scanners, cameras, and/or interfaces to networks.Output system 312D may be any combination of output devices, such as oneor more monitors, printers, and/or interfaces to networks. As shown byFIG. 4, system 316 may include a network interface 320 (of FIG. 3)implemented as a set of HTTP application servers 400, an applicationplatform 318, tenant data storage 322, and system data storage 324. Alsoshown is system process space 402, including individual tenant processspaces 404 and a tenant management process space 410. Each applicationserver 400 may be configured to tenant data storage 322 and the tenantdata 323 therein, and system data storage 324 and the system data 325therein to serve requests of user systems 312. The tenant data 323 mightbe divided into individual tenant storage areas 412, which can be eithera physical arrangement and/or a logical arrangement of data. Within eachtenant storage area 412, user storage 414 and application metadata 416might be similarly allocated for each user. For example, a copy of auser's most recently used (MRU) items might be stored to user storage414. Similarly, a copy of MRU items for an entire organization that is atenant might be stored to tenant storage area 412. A UI 430 provides auser interface and an API 432 provides an application programmerinterface to system 316 resident processes to users and/or developers atuser systems 312. The tenant data and the system data may be stored invarious databases, such as one or more Oracle™ databases.

Application platform 318 includes an application setup mechanism 438that supports application developers' creation and management ofapplications, which may be saved as metadata into tenant data storage322 by save routines 436 for execution by subscribers as one or moretenant process spaces 404 managed by tenant management process 410 forexample. Invocations to such applications may be coded using PL/SOQL 434that provides a programming language style interface extension to API432. A detailed description of some PL/SOQL language embodiments isdiscussed in commonly owned co-pending U.S. Provisional PatentApplication 60/828,192 entitled, PROGRAMMING LANGUAGE METHOD AND SYSTEMFOR EXTENDING APIS TO EXECUTE IN CONJUNCTION WITH DATABASE APIS, byCraig Weissman, filed Oct. 4, 2006, which is incorporated in itsentirety herein for all purposes. Invocations to applications may bedetected by one or more system processes, which manages retrievingapplication metadata 416 for the subscriber making the invocation andexecuting the metadata as an application in a virtual machine.

Each application server 400 may be communicably coupled to databasesystems, e.g., having access to system data 325 and tenant data 323, viaa different network connection. For example, one application server 400₁ might be coupled via the network 314 (e.g., the Internet), anotherapplication server 400 _(N-1) might be coupled via a direct networklink, and another application server 400 _(N) might be coupled by yet adifferent network connection. Transfer Control Protocol and InternetProtocol (TCP/IP) are typical protocols for communicating betweenapplication servers 400 and the database system. However, it will beapparent to one skilled in the art that other transport protocols may beused to optimize the system depending on the network interconnect used.

In certain embodiments, each application server 400 is configured tohandle requests for any user associated with any organization that is atenant. Because it is desirable to be able to add and remove applicationservers from the server pool at any time for any reason, there ispreferably no server affinity for a user and/or organization to aspecific application server 400. In one embodiment, therefore, aninterface system implementing a load balancing function (e.g., an F5Big-IP load balancer) is communicably coupled between the applicationservers 400 and the user systems 312 to distribute requests to theapplication servers 400. In one embodiment, the load balancer uses aleast connections algorithm to route user requests to the applicationservers 400. Other examples of load balancing algorithms, such as roundrobin and observed response time, also can be used. For example, incertain embodiments, three consecutive requests from the same user couldhit three different application servers 400, and three requests fromdifferent users could hit the same application server 400. In thismanner, system 316 is multi-tenant, wherein system 316 handles storageof, and access to, different objects, data and applications acrossdisparate users and organizations.

As an example of storage, one tenant might be a company that employs asales force where each salesperson uses system 316 to manage their salesprocess. Thus, a user might maintain contact data, leads data, customerfollow-up data, performance data, goals and progress data, etc., allapplicable to that user's personal sales process (e.g., in tenant datastorage 322). In an example of a MTS arrangement, since all of the dataand the applications to access, view, modify, report, transmit,calculate, etc., can be maintained and accessed by a user system havingnothing more than network access, the user can manage his or her salesefforts and cycles from any of many different user systems. For example,if a salesperson is visiting a customer and the customer has Internetaccess in their lobby, the salesperson can obtain critical updates as tothat customer while waiting for the customer to arrive in the lobby.

While each user's data might be separate from other users' dataregardless of the employers of each user, some data might beorganization-wide data shared or accessible by a plurality of users orall of the users for a given organization that is a tenant. Thus, theremight be some data structures managed by system 316 that are allocatedat the tenant level while other data structures might be managed at theuser level. Because an MTS might support multiple tenants includingpossible competitors, the MTS should have security protocols that keepdata, applications, and application use separate. Also, because manytenants may opt for access to an MTS rather than maintain their ownsystem, redundancy, up-time, and backup are additional functions thatmay be implemented in the MTS. In addition to user-specific data andtenant specific data, system 316 might also maintain system level datausable by multiple tenants or other data. Such system level data mightinclude industry reports, news, postings, and the like that are sharableamong tenants.

In certain embodiments, user systems 312 (which may be client systems)communicate with application servers 400 to request and updatesystem-level and tenant-level data from system 316 that may requiresending one or more queries to tenant data storage 322 and/or systemdata storage 324. System 316 (e.g., an application server 400 in system316) automatically generates one or more SQL statements (e.g., one ormore SQL queries) that are designed to access the desired information.System data storage 324 may generate query plans to access the requesteddata from the database.

Each database can generally be viewed as a collection of objects, suchas a set of logical tables, containing data fitted into predefinedcategories. A “table” is one representation of a data object, and may beused herein to simplify the conceptual description of objects and customobjects. It should be understood that “table” and “object” may be usedinterchangeably herein. Each table generally contains one or more datacategories logically arranged as columns or fields in a viewable schema.Each row or record of a table contains an instance of data for eachcategory defined by the fields. For example, a CRM database may includea table that describes a customer with fields for basic contactinformation such as name, address, phone number, fax number, etc.Another table might describe a purchase order, including fields forinformation such as customer, product, sale price, date, etc. In somemulti-tenant database systems, standard entity tables might be providedfor use by all tenants. For CRM database applications, such standardentities might include tables for Account, Contact, Lead, andOpportunity data, each containing pre-defined fields. It should beunderstood that the word “entity” may also be used interchangeablyherein with “object” and “table”.

In some multi-tenant database systems, tenants may be allowed to createand store custom objects, or they may be allowed to customize standardentities or objects, for example by creating custom fields for standardobjects, including custom index fields. U.S. patent application Ser. No.10/817,161, filed Apr. 2, 2004, entitled “Custom Entities and Fields ina Multi-Tenant Database System”, and which is hereby incorporated hereinby reference, teaches systems and methods for creating custom objects aswell as customizing standard objects in a multi-tenant database system.In certain embodiments, for example, all custom entity data rows arestored in a single multi-tenant physical table, which may containmultiple logical tables per organization. It is transparent to customersthat their multiple “tables” are in fact stored in one large table orthat their data may be stored in the same table as the data of othercustomers.

While one or more implementations have been described by way of exampleand in terms of the specific embodiments, it is to be understood thatone or more implementations are not limited to the disclosedembodiments. To the contrary, it is intended to cover variousmodifications and similar arrangements as would be apparent to thoseskilled in the art. Therefore, the scope of the appended claims shouldbe accorded the broadest interpretation so as to encompass all suchmodifications and similar arrangements.

1-20. (canceled)
 21. A method, comprising: maintaining, by one or moreservers of a computer data center, a plurality of instances of adatabase system, wherein each of the plurality of instances isassociated with a plurality of tenants and is separately configured toprovide functionality of the database system to the associated pluralityof tenants; receiving, by the one or more servers from a first userassociated with one of the plurality of tenants, a first request tocreate a custom subdomain within a domain of the one or more servers; inresponse to receiving the first request, the one or more servers:creating the custom subdomain within the domain of the one or moreservers; and associating the custom subdomain with an instance of theplurality of instances capable of executing an application of thetenant; receiving, by the one or more servers from a second user, asecond request for content from the application of the tenant, whereinthe second request specifies the custom subdomain; and in response toreceiving the second request, the one or more servers: determining theinstance from the plurality of instances based on the custom sub domain;and routing the second request to the application executing on theinstance.
 22. The method of claim 21, wherein the determining theinstance includes: looking-up, by the one or more servers, the instancein a look-up table using the custom subdomain, wherein the look-up tableindicates instances associated with ones of the plurality of tenants.23. The method of claim 21, wherein the associating includes: creating,by the one or more servers, a record that maps the custom subdomain tothe instance that executes the application of the tenant.
 24. The methodof claim 21, further comprising: in response to migrating applicationsof the tenant to a different instance of the plurality of instances, theone or more servers associating the custom subdomain with the differentinstance.
 25. The method of claim 21, further comprising: subsequent tocreating the custom subdomain, the one or more servers preventing thetenant from changing the custom subdomain to a different customsubdomain.
 26. The method of claim 21, further comprising: prior torouting the second request to the application, the one or more serversdetermining whether the second request is associated with the tenantbased on the custom subdomain; and based on determining that the secondrequest is associated with the tenant, the one or more servers verifyingthat the second user is included in a set of users associated with thetenant.
 27. The method of claim 21, wherein the creating of the customsubdomain includes: validating, by the one or more servers, that thecustom subdomain is unique and is not a prohibited domain.
 28. Anon-transitory, computer-readable medium having program instructionsstored thereon that are capable of causing one or more servers toperform operations comprising: maintaining a plurality of instances of adatabase system, wherein one or more of the plurality of instances arecapable of executing applications of a plurality of tenants associatedwith the one or more servers; in response to receiving a first requestfrom a first user associated with one of the plurality of tenants tocreate a custom subdomain that is within a domain of the one or moreservers, associating the custom subdomain with one of the plurality ofinstances that is capable of executing an application of the tenant; inresponse to receiving a second request from a second user for contentfrom the application of the tenant: determining the instance from theplurality of instances based on the second request identifying thecustom subdomain; and routing the second request to the applicationexecuting on the instance.
 29. The non-transitory, computer-readablemedium of claim 28, wherein the operations further comprise: causing adomain name system (DNS) alias to be created that maps the customsubdomain to the instance associated with the tenant.
 30. Thenon-transitory, computer-readable medium of claim 29, wherein theoperations further comprise: in response to applications including theapplication and data of the tenant being moved to a different instanceof the plurality of instances, determining to cause the DNS alias to beupdated to map the custom subdomain to the different instance.
 31. Thenon-transitory, computer-readable medium of claim 28, wherein theoperations further comprise: maintaining a lookup table that associatescustom subdomains with ones of the plurality of instances, wherein theinstance is determined using the lookup table and the custom subdomain.32. The non-transitory, computer-readable medium of claim 28, whereinthe operations further comprise: prior to routing the second request,determining whether the second request is associated with the tenantbased on the custom subdomain; and based on determining that the secondrequest is associated with the tenant, determining whether the tenanthas exceeded an allotted amount of bandwidth before using bandwidth toroute the second request.
 33. The non-transitory, computer-readablemedium of claim 28, wherein the operations further comprise: providing,to one or more users of the tenant, web browser cookies that areassigned to the custom subdomain.
 34. The non-transitory,computer-readable medium of claim 28, wherein the operations furthercomprise: prior to receiving the first request, providing a setup pageto the first user of the tenant, wherein the setup page requests acustom subdomain name from the first user, and wherein the first requestis received in response to the first user submitting a requested namefor the custom subdomain through the setup page.
 35. An apparatus,comprising: one or more processors; and memory having programinstructions stored thereon that are capable of causing the one or moreprocessors to perform operations comprising: maintaining a plurality ofinstances of a database system, wherein a given one of the plurality ofinstances is associated with a plurality of tenants and is capable ofexecuting one or more applications associated with the plurality oftenants; in response to receiving a first request from a first user toassociate a custom subdomain with a particular one of the plurality ofinstances, causing one or more records to be created that associate thecustom subdomain with the particular instance; receiving, from a seconduser, a second request for access to an application associated with thesecond user that is executing on the particular instance, wherein thesecond request specifies the custom subdomain; in response to receivingthe second request, determining the particular instance from theplurality of instances based on the one or more records and the customsubdomain; and routing the second request to the application executingon the particular instance.
 36. The apparatus of claim 35, wherein theoperations further comprise: based on the application being moved to adifferent instance of the plurality of instances, causing the one ormore records to be updated to associate the custom subdomain with thedifferent instance.
 37. The apparatus of claim 35, wherein thedetermining of the particular instance includes: using a lookup tablethat maps custom subdomains to ones of the plurality of instances onwhich a respective tenant associated with a respective custom subdomainis located, wherein the lookup table includes the one or more records.38. The apparatus of claim 35, wherein the operations further comprise:determining an organization associated with the custom subdomainspecified in the second request; and prior to routing the secondrequest, determining whether the second user is included in a set ofvalid users for the organization.
 39. The apparatus of claim 35, whereinthe causing of the one or more records to be created includes: causing adomain name system (DNS) alias to be created that maps the customsubdomain to the particular instance.
 40. The apparatus of claim 35,wherein the apparatus is a multi-tenant database system that isaccessible via a domain, and wherein the custom subdomain is a subdomainwithin the domain.